AI Agent Payments Stuck in Deadlock Over Authorization and Trust

Written by Vignesh Sreedhar, Software Engineer at Meta

Compiled by AididiaoJP, Foresight News

Consumer-grade AI agents are booming; this article focuses solely on the traditional bank card payment system in B2C scenarios.

AI agents are browsing websites, filling out forms, and increasingly placing orders directly. Although they are meant to act strictly according to consumer authorization, they may still produce incorrect or unintended results, performing actions that do not reflect the consumer’s true intent. Anyone who has built, used, or interacted with agents knows this can happen at any time.

Suppose I ask an AI agent to book a hotel: two nights, total cost under $600, free cancellation until the day before check-in, and within walking distance of a specific venue. The agent finds the correct hotel at $580 and completes the payment. The problem is, it booked a non-refundable rate. The card is valid, the merchant is legitimate, and the amount is within budget—but this is still an incorrect purchase. This can happen whether there is a human in the loop (requiring immediate confirmation) or no human in the loop (autonomous execution).

This raises the fundamental issue: a payment can succeed yet still contradict the user's intent. There are two scenarios behind this.

First, the intent has not been accurately or fully understood. A natural language request must be converted into clear conditions that the user can confirm and other parties can verify. This conversion process may omit or misinterpret critical conditions, such as whether a refund is possible, the delivery date, or whether an exchange is allowed. Currently, there is no standard format for intent—although each card network claims to have one—so if the request is ambiguous or unclear, it may result in an incorrect purchase.

Second, the agent’s actions deviate from clearly stated intentions. Even when requests are clear, the agent may hallucinate, rely on outdated information, lose context during multi-step operations, misinterpret checkout options, be manipulated by malicious prompts, or make errors or encounter bugs during checkout.

Given these risks, let’s examine how they impact each key participant in trading.

Consumers: Lack of trust. Consumers need assurance that agents will purchase exactly what they want, safeguard their payment information, and provide clear remedies if issues arise. A NMI survey of 1,000 U.S. adults found that 69% do not trust AI to handle payments securely, 70% want to review or override AI’s decisions before placing an order, and only 10% are willing to delegate purchasing entirely to AI. Currently, most agent-driven purchases come from a small group of tech pioneers (likely including venture capitalists), while general users remain hesitant to entrust payments to agents.

Merchants, PSPs, and acquirers: Fraud and chargeback risks. Merchants are in a worse position. They must distinguish between legitimate shopping agents and malicious bots, and defend themselves when orders are later disputed as “unauthorized” or “contrary to customer instructions.” Their PSPs—especially fraud prevention providers like Forter, Riskified, Signifyd, Sift, Accertify, and Sardine—and acquirers must assess this risk and handle disputes without any visibility into user intent. All fraud prevention providers currently rely on signals provided by merchants, who can only collect these signals when users shop on their own websites.

Issuing bank: Approves payments without any context. The issuing bank decides whether to authorize a payment and evaluates disputes, but like merchants, it cannot see what the user actually authorized. Given this, how can issuing banks assume credit risk? They cannot confidently distinguish between fraudsters, agent errors, and legitimate authorized purchases.

Card networks: Responsibility and intent are missing from transactions. Card networks are the rule-makers: they need a consistent set of rules to identify authorized transactions, allocate losses, and assign responsibility. Without evidence being passed between parties, each party can only see a portion of the transaction, making it difficult to determine accountability.

Agency companies: Need to monetize. Agency companies urgently require a sustainable way to monetize transactions, but simply facilitating purchases does not establish who should pay or why. Common proposals include taking a commission from merchants (percentage-based or affiliate programs), but neither path has succeeded in the past. Instant Checkout failed for this reason: launched by OpenAI in September 2025, it had already retreated to product discovery and merchant-owned checkout by March 2026. Affiliate programs also struggle to scale—agencies must build relationships and onboard merchants one by one, each with its own terms, tracking, and settlement methods, yet even then they only cover a small fraction of agency activity. Moreover, why should merchants pay affiliate fees while bearing disproportionate risk?

Negative flywheel effect. These gaps reinforce each other: unclear authorization and responsibility lead merchants to block transactions, issuers to tighten checks, and approval rates to drop, interrupting checkout. As the experience deteriorates, users become less willing to entrust purchases to agents. Consumer trust is also fragile: YouGov surveyed 2,080 UK adults for ACI, and 60% said they would disable an AI shopping agent after just one mistake.

The key point is: even if models advance to the point where agents fully understand and follow user intent, the problems remain. No matter how perfect an agent is, its executed intentions are invisible to others; fraud, chargebacks, and dispute risks in the ecosystem are unchanged: merchants still cannot distinguish between legitimate agents and malicious actors, issuers still cannot verify what users actually authorized, and users’ claims cannot be proven or disproven.

I won't cover each company individually, but I'll explain the broader agency payment solutions that have already gained attention.

Auto-fill original card number

A surprisingly common practice is to store users’ real card information in a vault and use a browser proxy to auto-fill it into merchants’ payment forms. Major personal proxies like Instinct and Hark Labs operate this way. Although Instinct has begun supporting Stripe Link, the vault remains in place.

Instinct’s payment operations run on a cloud-based virtual desktop, making it inconvenient to demonstrate live. So I tested Hark’s vault instead—it automatically filled my raw card number and CVV into the payment form without any masking. Even more concerning, despite these agents claiming high daily active users and high valuations, very few have pointed out this obvious security vulnerability.

Elon Musk also posted a tweet saying you can send a photo of your credit card to the Grok Bot, drop it into the chat, and let it shop online. However, xAI’s own terms clearly state: “The Grok Bot may retain customer data, files, browser sessions, credentials, memories, and routines in persistent cloud environments... Deleting the Bot may not delete shared files, sessions, credentials, or routines.”

Are these companies PCI compliant? Auto-filling card numbers itself does not necessarily violate PCI, but storing and exposing payment credentials imposes significant security and compliance obligations. PCI DSS prohibits service providers from retaining CVVs for future purchases, including through provider-managed vaults or browser auto-fill. I see no mention of PCI compliance certification in the terms of several companies, so these practices exist in a gray area.

Agentcard (a YC S26 company that provides card vaulting for agents) has an interesting solution. Technically PCI-compliant and similar to 1Password: users encrypt and store their original card details, which Agentcard itself cannot access. It requires browser integration for agents (Kernel, Browserbase), and transactions are approved via Face ID. Ultimately, merchants receive the actual credit card information. Agentcard deserves praise—it has found a novel, PCI-compliant way for agents to make payments using original card details. Even if agent browsers become standard and users embrace this 1Password-like approach, I believe it remains a solid transitional solution until agent tokens achieve true scale. They also support auto-approval: users can set thresholds (e.g., auto-approve amounts under $50) when saving cards. Agentcard currently supports 30 PSPs, including Stripe, Shopify, and Worldpay.

Proxy token

You can make payments without sharing your actual card details—this has long been possible through tokenization. Here, “token” does not refer to cryptographic tokens on a blockchain, but rather a substitute payment credential that replaces your real card number. Apple Pay’s device-specific credentials are an example of tokenization; merchants also use card network tokens to improve authorization rates and reduce fraud. Tokens can be restricted to specific devices, merchants, or use cases. Proxy tokens are card network tokens that represent a consumer’s existing card, accompanied by services such as proxy identity, authentication instructions, and payment controls. Over the past year, Visa, Mastercard, and American Express have each launched their own proxy token solutions.

Visa Intelligent Commerce (VIC) is the first agent tokenization scheme. According to Visa’s disclosed process, users first verify their card and set up a passkey, then authenticate authorization for agent-initiated purchases. When an agent requests a checkout credential (i.e., an agent token), Visa enforces card network controls based on the original instruction. During payment authorization, VisaNet verifies the instruction, which includes high-level authorization conditions such as spending limits, credential validity periods, and merchant domain names. However, each major agent platform has passkey exemptions—this will be explained later as why it is critical for issuers.

Mastercard Agent Pay works the same way, beginning with agent registration, obtaining user consent, and authentication. Mastercard’s tokenization service issues tokens representing the user’s existing card for the agent’s use. According to its disclosed advanced checkout flow, the agent submits purchase details and constraints via the Intent API and receives an intent ID and a tokenized payment credential in return.

AmEx’s Agentic Commerce Experiences (ACE) break registration, intent approval, and credential acquisition into three steps. Account enablement allows users to register their card with a verified agent and complete issuer authentication. As both the issuer and the card network, AmEx maintains full control over the entire issuance lifecycle. The agent calls the Create Intent API to submit a purchase instruction and constraints, and then exchanges a proof token for a restricted-range checkout credential when preparing to pay.

From a cross-network perspective, two key decisions are critical: issuance and payment authorization. Issuance determines whether a card can be registered and whether an agent can create usable tokens. Authorization (as it is today) determines whether the payment is approved once the credentials reach checkout. Given these solutions, why not use them directly? The issue is that several issuers currently do not support cross-network issuance of these tokens. Major banks like Chase explicitly do not support agent tokens, and many other issuers still cannot reliably support them. In addition, authorization friction is significant, with high 3D Secure challenge rates.

The tokenization schemes introduced by card networks sound great in theory, but most real-world implementations face difficulties due to two reasons—technical architecture and issuer resistance.

Crossmint targets the gap where these issuing banks do not support tokenized cards. It does not issue new cards but instead uses the user’s own card. During registration, it first checks whether the card supports tokenization (VIC, Agent Pay, or ACE); if not, it falls back to a PCI-compliant vault that transmits the card number directly: the card number is encrypted using a public key generated by a proxy browser, computer usage, or UCP component, and decrypted locally at checkout to auto-fill the details. Alfongi told me that Crossmint has discussed this approach with Visa and Mastercard, and ultimately chose not to issue virtual cards because the card networks have assured them they will never permit it in the long term.

The real-world performance hasn't been that great either. Crossmint acknowledges that authorization and issuance rates have still been subpar, but have improved over the past two to three months. Their data shows Mastercard performing significantly better, while Visa—especially Chase and commercial cards—is underperforming.

Card networks can define credentials and controls, but issuing banks must still assess risk and serve cardholders when issues arise. Without reliable evidence of user authorization or confirmation that the purchase aligns with intent, issuing banks cannot assume the additional risk introduced by agent delegation. American Express, as both a card network and an issuing bank, has a unique advantage—it explicitly emphasizes delivering intent to the issuing bank before execution. This is precisely where the passkey exemption is problematic: passkeys are the single step by which cardholders prove they authorized the instruction, and exempting every major agent platform from passkeys causes issuing banks to lose this critical signal precisely when they need it most.

For reference, Stripe was the first company to roll out this approach at scale, but I know several others have already or are in the process of building issuance programs.

How it works: An intermediary issues a new card (typically a single-use virtual card) to the agent. Each purchase is split into two steps: your card pays Link, and Link’s card pays the merchant. Link has become the de facto agent wallet, with agent purchases growing 38-fold month-over-month as of September 2026.

Financial breakdown: Before deducting program costs and payments to agents, credit card funds generate a margin of approximately $0.40 on a $100 purchase. On the user side: Link appears on your statement, category rewards do not apply, and disputes or refunds are routed back to the merchant via Link. On the merchant and issuer side: Merchants receive a commercial card with no risk data, resulting in acquiring costs up to 200 basis points higher; issuers lose access to merchant-level data. On the card network side: Visa prohibits real-time card pre-funding outside its staged wallet rules. Mastercard went further in its Q3 2026 earnings call: CEO Michael Miebach stated, “We do not support issuing one-time virtual card numbers for transaction pre-funding,” describing VCNs as bridges, “not a long-term solution we will support.”

The operators I’ve spoken with have expressed the same idea from another angle: current approaches are converging toward issuing trusted virtual cards. The problem is clear—when you’re essentially designing for a MOR/card-to-card funding model, the accounting simply doesn’t add up. Privacy.com spent over a decade perfecting this model: they implemented sophisticated strategies to optimize acquiring costs and card network fees, fine-tuned fraud models, and handled credit and transaction loss underwriting, customer service, and chargebacks in-house. Stripe might be willing to aggressively push forward and absorb massive losses to gain market share.

The card networks are taking a nuanced stance. While some franchise teams within the card networks dislike front-end solutions, the networks actually earn more because each purchase adds additional swipe steps. BNPL models like Affirm/Klarna exemplify this: they use virtual cards to process payments at e-commerce POS terminals with buy-now-pay-later merchants, then collect installment payments from the consumer’s underlying debit card. Moreover, Visa will never let Mastercard gain an advantage in the agency space, and vice versa. As a result, both will make exceptions to support transitional solutions—just as they have done with stablecoin settlement and cross-border issuance exemptions.

On October 26, Stripe launched Link Balance for agents, initially rolled out through Instinct. The architectural change separates funds from individual purchases: consumers pre-load funds and grant spending permissions, allowing agents to act on their behalf when they are unavailable. In short:

How it works: A completed KYC pre-funded balance, held as a stablecoin (USDC on Tempo) in a Privy wallet, is spent via a consumer prepaid Visa card issued by Lead Bank, which qualifies for the Durbin exemption.

Why use stablecoins: Using stablecoins shifts authorization authority to the wallet layer and enables Stripe’s distribution capabilities—a programmable balance that can pay both traditional card merchants and machine payment rails (such as Stripe’s Machine Payments Protocol), while also deploying USD balances overseas without needing to build local deposit products in each market. However, this balance is not FDIC-insured.

Financial breakdown: Debit top-ups are cost-effective, at approximately $0.26 per $100; purchases earn about $1.95 in transaction fees per $100; plus, interest accrues on idle balances, and this float would increase further if Link transitions to Bridge’s OUSD.

Responsibility: You bear the consequences of the agent’s mistakes. Link’s terms do not cover unauthorized transactions; your original card issuer only sees one deposit.

This is currently the most mature solution for agent companies to process payments and cash out, but it makes things worse for consumers, merchants, issuers, and card networks. The article above includes a full breakdown, figures, and sources.

Shopify has taken the opposite path from merchants like Amazon—while Amazon directly blocks agents such as Meta’s Muse from purchasing on its site, in January, Shopify partnered with Google to launch the Universal Commerce Protocol (UCP), enabling agents to search for products, add items to carts, and check out across merchants. In September, Shopify extended WebMCP support to the checkout process, including Shop Pay, covering all eligible merchants. This allows browser-based agents to read, update, and complete checkouts using structured tools, eliminating the need for screenshots and scraping. Shopify has also partnered directly with Muse and Instinct, though reports indicate they do not share economic revenue with agent companies as Stripe does. Regarding payments, Shop Pay uses agent tokens for non-Shopify stores; as previously mentioned, the authorization and issuance rates for these agent tokens remain poor.

Several third parties are building on top, such as Crossmint and Sapiom. Crossmint’s headless checkout API enables merchants to use UCP and WebMCP if supported, or a custom browser tool if not. It claims to cover 90% of e-commerce websites with a median setup time of less than two minutes. Additionally, note Agentcard’s opencommerce.sh: by providing agents with an endpoint and SDK, it enables them to search for products, check out, and track orders across 5,026 stores. After users approve their cart, payments are processed through Agentcard’s vault, with Stripe Link and Shop Pay support coming soon. A 1% fee is charged per completed order.

But this only addresses the checkout process. Shopify, Crossmint, Agentcard, and others make it easier for agents to complete purchases, but they don’t change one thing: who bears the risk when an agent buys the wrong item.

Commerce is essentially a multilateral risk network, where both merchants and issuers hold veto power. Even if consumers spend all day trying to get an agent to make purchases on their behalf, the transaction won’t proceed unless the merchant (the party providing the goods) accepts it or the issuer (the party providing purchasing power) authorizes it—most likely, the user will simply place the order themselves.

You might argue that consumer demand alone can drive a positive flywheel: as more people use proxy shopping, merchants will naturally build the infrastructure to accept these payments, bypassing resistant issuers and card networks, with players like Stripe and Shopify leading the proxy commerce space.

I think this is not impossible, largely because Stripe is playing a very long game. As Alfongj said, Visa built its empire by controlling both ends of the road—Stripe is now holding both ends: on one side, merchants, with businesses on Stripe processing $1.9 trillion last year; on the other, consumers, with over 350 million people using Link, which is pre-installed in popular apps.

Around these two components, Stripe has pieced together the rest of the network: Tempo for rails, OUSD for currency, and MPP for protocol. Once Link balances on Tempo can be paid to Stripe merchants via MPP, a complete payment path bypasses Visa—no interchange fees, no chargeback risk, and instant settlement for merchants.

This path will surely face obstacles from issuers, card networks, and possibly users at every level. But Stripe is betting on this ambitious vision: creating a closed-loop network for agent commerce. They should make this bet.

However, I believe the likelihood of this succeeding is quite low, for two reasons.

First, the barrier is extremely high. Over the past decade, the payment experience has been refined to be increasingly seamless: saving payment details, one-click checkout, digital wallets like Apple Pay—all of which were introduced alongside tokenization by wallets and card networks in 2014. Today’s checkout process is the result of decades and hundreds of billions of dollars in investment, nearing optimal efficiency. How mature is it? Global payment revenues grew by only 3% from 2024 to 2025, compared to an average annual growth of 11% in previous years. Therefore, if agency-based experiences are worse—resulting in more chargebacks, more verification hurdles, and more blocked sessions—people won’t adopt them at scale. They’ll simply bypass the agent and buy directly.

Second, trust. Payments are extremely sensitive, and trust is extremely fragile. Many agencies treat PCI compliance as an afterthought, which can lead to numerous security incidents. Unintended purchases may also occur: without consumer protection, no dispute rights, no rules, and no ecosystem participant willing to take responsibility. Just one bad experience—a mistaken payment, a block by a merchant or issuer, or a security breach—is enough to make someone never use it again.

Building trust in payments takes a very long time. The first secure online card payment was a Sting CD purchased in August 1994. By the fourth quarter of 1999, e-commerce accounted for only 0.64% of U.S. retail; by 2010, it was 4.2%; today, it’s just 17.1%. That’s整整 30 years. And behind this growth lies institutional trust: Visa’s zero liability policy in 1997, 3DS in 2001, PCI DSS in 2004, tokenization by card networks and Apple Pay in 2014. Agent payments have none of these. While people around you using it might encourage you to try, what truly enables scale is institutional trust.

Moreover, we are building an ecosystem where the incentives of all parties are fundamentally misaligned:

Card networks want to preserve their influence. They’ve built proxy tokens, passkeys, and intent APIs—which barely capture true intent—to keep proxy commerce running on their own tracks and rules. But issuers like Chase simply won’t issue them, and every major proxy platform has passkey exemptions. Worst of all, they compete against each other, their standards clash, and their rules are fragmented. They shouldn’t be complacent either: Stripe is betting it will become the true giant in payments, and anyone competing with Stripe is in a tough spot.

Merchants are playing defense. Large merchants are hiring agents to handle the increased transaction volume, but they’re still relying on black-box fraud models designed for humans: mismatched IP addresses, browser session histories, fingerprints, geographic locations, and so on. Hundreds of companies are talking about KYA and complex fraud models, but none have sufficient reach or distribution to truly capture interest. I even believe that without understanding the people and intentions behind the agents, KYA simply won’t work—and agent companies won’t readily hand over that information.

Issuing banks cannot ethically insure transactions they barely see. But they could take the lead here. As Nikil Konduru noted, only issuing banks have the full suite of capabilities to cover for agents’ mistakes: surcharging fees, underwriting, funding verification, and dispute resolution. They could require agents to submit intent before authorization to qualify for purchase protection, then combine that intent with cross-merchant purchase histories to finally build the retail media network they’ve long desired. But issuing banks move slowly, and this model would only work if the five largest banks collectively pushed for it before standards were set—which they likely won’t. Agents also have no incentive to individually partner with issuing banks—wallets are already widely accepted, and no one wants to shop through bank apps.

The agency needs scalable GMV monetization to pay its compute bills, so it will use whatever method today enables purchases and delivers payment—whether that’s tapping into reserve inventory of physical cards, issuing via Link, or negotiating custom agreements with merchants—regardless of the cost incurred by the merchant, issuer, or card network.

They also benefit from favorable macroeconomic tailwinds. In the first quarter of 2026, AI accounted for approximately 80% of the $300 billion in global venture funding; OpenAI and Anthropic raised about $217 billion combined in the first half of the year; Alphabet, Amazon, Microsoft, and Meta plan to spend approximately $725 billion on AI infrastructure in 2026, a 77% year-over-year increase. Consumer-facing agents are equally well-funded: Instinct, which launched in invite-only mode in August, raised $1 billion at a $10 billion valuation in September—just one month after raising funds at a $2.5 billion valuation.

With so much money, influence, and pressure placed on consumer-grade AI, and agency commerce emerging as a viable monetization path, agencies and their investors won’t wait for the payments ecosystem to figure itself out slowly. They’ll act quickly to make it happen—whether or not others are ready. This is precisely what Stripe and other companies betting on “agency services” have done so intelligently.

But I believe they ultimately rely on these users to generate revenue. For all the reasons mentioned above, users won’t adopt them at scale unless the entire business ecosystem is motivated to make it work.

If only users benefit but merchants don’t, it won’t grow. If only merchants benefit but issuing banks don’t, it won’t grow. If only issuing banks benefit but agent companies don’t, it still won’t grow.